--- title: "#web-app-security articles | Hashnode" description: "Explore 37 articles tagged #web-app-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/web-app-security" --- Tag # #web-app-security 37 posts · 0 followers [James Miller](https://hashnode.com/@jamesmiller45900) · [Sep 10](https://hashnode.com/posts/why-authenticated-security-testing-is-becoming-essential-for-modern-web-applications/6aa2a3739148f7c85f651d84) ### [Why Authenticated Security Testing is Becoming Essential for Modern Web Applications](https://jamesmiller459.hashnode.dev/why-authenticated-security-testing-is-becoming-essential-for-modern-web-applications?utm_source=hashnode&utm_medium=feed) Learn why authenticated security testing is essential for modern web apps and how it uncovers hidden vulnerabilities behind login. 7 min read · [jamesmiller459.hashnode.dev](https://jamesmiller459.hashnode.dev/why-authenticated-security-testing-is-becoming-essential-for-modern-web-applications?utm_source=hashnode&utm_medium=feed) [Sreerag Pramod](https://hashnode.com/@sreeragpramod) · [Jul 27](https://hashnode.com/posts/excessive-trust-in-client-side-controls/6a67761e875c0e45003d11d1) ### [Excessive Trust in Client-Side Controls](https://sreeragpramod.hashnode.dev/excessive-trust-in-client-side-controls?utm_source=hashnode&utm_medium=feed) How trusting client-sent price data instead of server-side validation let me buy a $1337 item for one cent, a business logic walkthrough. 10 min read · [sreeragpramod.hashnode.dev](https://sreeragpramod.hashnode.dev/excessive-trust-in-client-side-controls?utm_source=hashnode&utm_medium=feed) [Amanda Allen](https://hashnode.com/@amandaallen) · [Jun 25](https://hashnode.com/posts/playwright-based-application-journey-testing-patterns-for-modern-engineering-teams/6a3d1ccfd8b95a8c3da4e0e6) ### [Playwright-Based Application Journey Testing Patterns for Modern Engineering Teams](https://amandaallen.hashnode.dev/playwright-based-application-journey-testing-patterns-for-modern-engineering-teams?utm_source=hashnode&utm_medium=feed) Learn how Playwright improves security testing by analyzing user journeys, workflow behavior, and authenticated application flows. 5 min read · [amandaallen.hashnode.dev](https://amandaallen.hashnode.dev/playwright-based-application-journey-testing-patterns-for-modern-engineering-teams?utm_source=hashnode&utm_medium=feed) [Thuriaanandh V](https://hashnode.com/@thuriaanandh) · [Jun 14](https://hashnode.com/posts/sql-injection-labs-portswigger/6a2e581527b07cd9a09b1758) ### [SQL Injection Labs (Portswigger)](https://thuriaanandh-sec.hashnode.dev/sql-injection-labs-portswigger?utm_source=hashnode&utm_medium=feed) Sql Injection labs writeup(labs 1-6) 19 min read · [thuriaanandh-sec.hashnode.dev](https://thuriaanandh-sec.hashnode.dev/sql-injection-labs-portswigger?utm_source=hashnode&utm_medium=feed) [Thuriaanandh V](https://hashnode.com/@thuriaanandh) · [Jun 14](https://hashnode.com/posts/i-broke-cors-three-times-on-purpose-portswigger-academy-writeup/6a2e48a3eaf442ed27e09d03) ### [I Broke CORS Three Times on Purpose (PortSwigger Academy Writeup)](https://thuriaanandh-sec.hashnode.dev/i-broke-cors-three-times-on-purpose-portswigger-academy-writeup?utm_source=hashnode&utm_medium=feed) A portswigger lab writeup. 14 min read · [thuriaanandh-sec.hashnode.dev](https://thuriaanandh-sec.hashnode.dev/i-broke-cors-three-times-on-purpose-portswigger-academy-writeup?utm_source=hashnode&utm_medium=feed) [Amanda Allen](https://hashnode.com/@amandaallen) · [Jun 8](https://hashnode.com/posts/why-broken-access-control-continues-to-dominate-web-application-security-in-2026/6a265b4dda53fe2908d76e8a) ### [Why Broken Access Control Continues to Dominate Web Application Security in 2026](https://amandaallen.hashnode.dev/why-broken-access-control-continues-to-dominate-web-application-security-in-2026?utm_source=hashnode&utm_medium=feed) Learn why Broken Access Control remains the most common web application vulnerability and how organizations can reduce risk. 4 min read · [amandaallen.hashnode.dev](https://amandaallen.hashnode.dev/why-broken-access-control-continues-to-dominate-web-application-security-in-2026?utm_source=hashnode&utm_medium=feed) [Arpita Singhal](https://hashnode.com/@arpitasinghal) · [May 30](https://hashnode.com/posts/guided-pentest-web-tryhackme/6a1a7829969596275007ce37) ### [Guided Pentest: Web | TryHackMe](https://arpitasinghal.hashnode.dev/guided-pentest-web-tryhackme?utm_source=hashnode&utm_medium=feed) Room: Guided Pentest: Web | Target: RecruitX — an internal recruitment portal 7 min read · [arpitasinghal.hashnode.dev](https://arpitasinghal.hashnode.dev/guided-pentest-web-tryhackme?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [May 8](https://hashnode.com/posts/moving-from-a-managed-waf-to-one-we-actually-owned/69fe54f7f239332df414195b) ### [Moving From a Managed WAF to One We Actually Owned](https://rr-cyber.hashnode.dev/moving-from-a-managed-waf-to-one-we-actually-owned?utm_source=hashnode&utm_medium=feed) A practical account of evaluating, proof-of-concepting, and migrating 100+ web assets to Imperva over four months, without taking down a single business-critical application. 10 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/moving-from-a-managed-waf-to-one-we-actually-owned?utm_source=hashnode&utm_medium=feed) [rathsara](https://hashnode.com/@rathsara) · [Apr 27](https://hashnode.com/posts/securing-200-web-assets-when-you-don-t-even-know-what-you-have/69ef39bedc472baafdc81fb9) ### [Securing 200+ Web Assets When You Don't Even Know What You Have](https://rr-cyber.hashnode.dev/securing-200-web-assets-when-you-don-t-even-know-what-you-have?utm_source=hashnode&utm_medium=feed) A practical walkthrough of building asset discovery, verification, classification, protection and governance across a multinational with 50+ business units, starting from zero visibility. 9 min read · [rr-cyber.hashnode.dev](https://rr-cyber.hashnode.dev/securing-200-web-assets-when-you-don-t-even-know-what-you-have?utm_source=hashnode&utm_medium=feed) [CyberFreak999](https://hashnode.com/@CyberFreak999) · [Mar 4](https://hashnode.com/posts/the-fundamentals-of-api-security-part-2/69a84107e55311e40fffc3c1) ### [The Fundamentals of API Security: Part 2](https://cyberfreak.hashnode.dev/the-fundamentals-of-api-security-part-2?utm_source=hashnode&utm_medium=feed) Explore API security testing techniques, business logic flaw detection, and runtime monitoring strategies. 3 min read · [cyberfreak.hashnode.dev](https://cyberfreak.hashnode.dev/the-fundamentals-of-api-security-part-2?utm_source=hashnode&utm_medium=feed)